Saturday, October 3, 2015

My review of Swing Browser (스윙 브라우저)

Today I'll take a look at a Korean home-grown web browser that I had seen a coworker using, called Swing Browser. Swing Browser (스윙 브라우저) is basically Google Chrome but surgically altered to support IE-only plug-ins. Why might one need such a browser, and is it worth using? Let's take a look.

Introduction

First, some background. Korea's internet banking security regulations often lead to a weird state where many use Chrome for their average web browsing, but open up Internet Explorer when it's time to make online purchases or use online banking services. A trick I've seen many coworkers do is to add all their online shopping items to their cart, then either log-in over on IE or switch to their smartphone to complete the purchase. Or, of course, many still just use IE as their one-and-only browser. Why switch when you know you'll need to come back to IE anyway? It isn't just banking either: many older sites, especially governmental sites, depend on older script-rendering engines to function. If you ever tried making a reservation on some government websites, or downloading files from some "cafe" sites, you'll know what I mean. Click all you want, friend; that link isn't going to click. Come back in IE and try again.

It it isn't ideal, and as anyone who lives here dealing with the hassles of the older Active-X plug-ins and their newer security software executables will tell you, it's also fairly unreliable. The need to uninstall and reinstall these small security apps (anti-keyloggers, site-specific firewalls, etc.) comes up often. Perhaps the most disconcerting part is that these mini-apps require elevated Administrator permissions. As a result, IE is still king.

Into this ecosystem comes Swing Browser. In theory it's an interesting concept: a custom-build from the Chromium open-source leads to a Chrome-like browser with better speed and rendering than IE, but that is also compatible with IE-specific security programs such as those banks and online transaction sites require. No more switching browsers! Let Swing Browser automatically switch "modes" for you when necessary. I have to admit, the idea sounded great, and led me to install it myself on an older Windows 7 machine, and give it a go.

To be fair, it does perform its stated duty. But after testing it out for a few days, I decided I'm better off doing my main browsing in Chrome, and switching to IE when necessary. Anyway, let's take a tour of what Swing Browser has to offer.

Swing Browser in action

Part 1: Search & New Tabs

Screenshot 1: new page, WebKit rendering engine

Here it is: Swing Browser. You'll immediately notice that it looks just like Chrome, and if you're already a Chrome user, you'll have no difficulty navigating around. You'll also notice that, yes, the browser is essentially entirely in English. A few settings or tooltips seem to have been, how can I say, perhaps translated by a non-native speaker, but overall I never felt unsure of how to use it. Don't let the language issue put you off. Some text is in Korean, but overall this is an entirely comfortable browser for English speakers.

Note also here one of the main features: that "SPEED" icon in the URL bar. It glows purple as you can see above, when the browser is using the WebKit rendering engine. In other words, it's in Chrome-mode, and webpages will render exactly as they should in real Google Chrome.

You'll also see several extensions in the upper toolbar that come pre-installed. I consider these bloatware, and totally unnecessary for the average non-Korean user. We'll get to those in a minute.

Screenshot 2: omnibar search results

Being vain, the first action I took was to search for myself "10wontips" in the URL/Omnibar. Rather than utilizing Google, the default search engine is "Zum", another product of ESTsoft, makers of the ALTools suite of utilities. You may know them as the makers of ALZip, that bulky version of 7zip, and ALyak (알약) (sorry, don't know how they choose to Anglicize this one), the antivirus on your girlfriend's computer that looks like an egg holding a pill.

I hope you're a fan of Zum and ALtools, because the integration runs deep here. Where Chrome is clearly immersed in the Google ecosystem, Swing Browser wants you immersed in their world.

Screenshot 3: Swing Browser login box

For example, you cannot "login" your Chrome Swing Browser session into your Google account like you can on regular Chrome. Trying to log-in will bring up this request to sign-in with your ALTools or Zum account. It seems to sync your history/passwords/extensions all the same, but of course that data is stored in their cloud, so unless you're using Swing Browser on multiple devices, or the ALToolbar on your other browsers, this is not going to be real helpful.

This is also an example of needing to read some Korean. You can actually log-in to Zum using your Facebook account, which simplifies the process a lot, but if you want to create an account normally you'll need to join in Korean.

Screenshot 4: new tab page

Once you've started using the browser, your new tab page will look something like this, with "recommended sites" up top and your most frequently visited sites below.

One interesting thing to note here, though I took this screenshot beforehand and now don't have a photo to show you of it, is that certain sites seem to get promoted to those top "recommended sites" bars. For example, you can see that right now the 은행 ("bank") bar is grayed-out. But after visiting KEB-Hana bank's website, that bank's link and favicon started occupying that space. That's actually a nice touch. I find that actually typing URLs is incredibly rare in Korea. A lot of people I know just search Naver for the name of the bank, then click the first search result. This may seem silly, and I've seen Koreans getting flack for it online, but I don't think it's a bad practice, because:

It's always possible you could make a typo and end up at a cleverly designed phishing site. Less likely Naver/Google/etc. would return the wrong listing.

It's only recently that non-Latin characters could be used in URLs, and in fact is still not very common. Remembering a precise set of foreign characters for each site is more difficult than just Googling the name. Go ahead, try to remember (and type!) http://правительство.рф. I'll wait.

So overall, I think auto-filling those new-tab buttons with the user's preferred banking site is a smart move, consumer-wise. It also does things like auto-correct some typos.

Part 2: Browser Settings & Extensions

Screenshot 5: browser option menu

Here's the menu you get when clicking the gear icon. Pretty standard Chrome-like menu. Maybe the only difference is that "Always use speed mode" option, which forces WebKit rendering on each page. But that would make no difference from using normal Chrome. Hey, whatever floats your boat.

Screenshot 6: browser settings

Getting into the settings menu. You can see that you can login to your ALTools account here. I didn't try this, but based on the wording, I'm guessing that any passwords you save in Swing Browser might also be synched up to the ALToolbar via the Auto Login feature, which you may have noticed is a preinstalled extension on Swing Browser. That could potentially be handy if, for example, you were using the ALToolbar on your Internet Explorer browser, so all your saved IE passwords would automatically be available in Swing Browser, and updates in either location would sync through. Not too shabby. If you're not immersed in the Google ecosystem, this could be a viable resource, especially if, God forbid, you would still from time to time need to move back to IE.

I often hear complaints of how un-tech-savvy Korean internet users are, but when you dive into features like this, you start to see that yes, it's entirely possible to live fairly productively online, even without Google, and even under some outmoded government regulations.

Screenshot 7: advanced settings

The advanced settings. Note that if you haven't logged in to ALpass, Swing will still save your passwords locally. Everything else seems pretty standard.

Screenshot 8: browser extensions

Here's where the fun starts. Hold on to your butts. Swing Browser can make use of normal Chrome Store extensions, but can also run extensions from its own special extension store.

Basically alerting you that you cannot use these extensions on your current browser, and encouraging you to download Swing.

Note that all of the extensions you see above came pre-installed. I'll talk more about these extensions in detail below in Part 3.

Screenshot 9: browser "About" page

About the browser.

Part 3: Swing Extensions & Tools

As I said, the Swing browser can make use of both Google Chrome Web Store extensions and extensions from its own homepage. There's not a huge amount available, but I'll write out a quick description here of what's available as of time of writing. All of these can be browsed at the Swing Extension Store.

The Scheduled Surfing Tool is basically a scheduled auto-site-opener. You pre-set the websites you want the browser to open (or to remind you to open) at dates/times you specified and it does the rest. Definitely one of the Korea-peculiar extensions, useful for things like semi-automating your Chuseok train ticket purchase, your Maroon 5 concert tickets purchase, or your online university course registration period. Basically anything online that can only be done in a very specific/limited time window, and is guaranteed to sell-out or fill-up almost immediately. You do not want to forget that.

Screenshot 12: Server time tool

Server time clock is a simple tool to find the clock time of the server you're connected to. Another weirdly Korean thing, but it goes hand-in-hand with the Scheduled Surfing tool. Tickets for the concert go on sale at exactly 5pm from Interpark. Sure, your watch says 4:48pm, but Interpark's web server clock is two minutes ahead. So by 4:58 you're getting in that last game of Clash of Clans while all the "real" fans are making purchases. You log-in two minutes later to discover that you are SOL. If only you'd known what time Interpark thinks it is! Well, now you do.

I don't think we need screenshots of each and every extension, so here's just a quick list of what else is available:

Mouse Actions - To do things like open a new tab when you move your mouse in an L shape while holding the right-click button. Seems 10x more bothersome to me than just Ctrl-T but to each his own.

"Compensation" aka Hacking Protection and the Anti-Phishing tool - Anti-phishing protection. Verifies that the URL you're at is the site you really want to be at. Of course, this type of service is already built into Google builds of Chrome, but remember, there's no Google integration in this Chrome build. OK you got me, I don't know what the difference is between the two, and don't care enough to investigate further.

QuickLink - Oh this is great. Say you're got, um, 32 tabs open to some "19" sites, and your boss/mom/wife/dog walks in. What do you do? Hit the "esc" key, and boom, harmless legitimate page appears. God, that this is included by default could speak volumes about Korean office work ethics and efficiency, but I'll leave that to other authors. You can also customize the key to press, and the URL that it directs to. So in theory it could have totally legit uses, but come on, we all know what it's here for.Be sure to check out the hilarious illustrations, showing a disgruntled employee stirring-up shit about her boss, when the boss walks in! F*ck! Thank God she thought fast, hit that QuickLink key, and looks like a model employee. Looks like. Because that's all that really matters.

And yes, eagle-eyed readers will note that most of these extensions are in fact built into the ALToolbar.

As a foreigner, some of these don't really have any usefulness to me, but I can see why they're included. Sure, I dislike companies preloading apps/extensions in my software too, but even Google Chrome comes preloaded with offline Docs/Sheets support, and I don't even use those tools online, much less offline. They're the first thing I remove in a fresh Chrome install, and similarly, any of these extensions you don't like in Swing can be removed easily.

Screenshot 13: Apps page

Not many other apps are included. There's Zum news, and another Zum service, the green one, Timetree (타임트리 ). As far as I can tell, it's basically just a news/sports/entertainment online magazine that tracks progressing stories chronologically. But I didn't give it much look.

Part 4 - Banking & IE Mode

Finally we come to the main reason why anyone would consider Swing Browser: online banking and purchasing. Cleverly, the browser knew when I had navigated to my bank's website (KEB-Hana bank), and you'll notice that the purple-glowing "SPEED" icon in the URL bar now dims to gray, and "IE rendering" mode is started.

I'm going to be honest with you. I am not a web browser expert. Clearly, Swing is doing something more than simply changing the user-agent ID. It's not just pretending to be IE. Somehow it reverts back to the older IE model of page rendering (Trident, I assume). But I'm no doctor, so I cannot tell you how it does this, only that it does seem to do it. Take a look.

Screenshot 14: installing bank security software

Here you can see the KEB-Hana proprietary security software being installed in an in-browser pop-up. Notice also the Veraport icon in the toolbar, and the elevated permissions prompt icon. It works. It bloody works. You saw it here, folks. Korean banking software actually working/running without hassle, on the first try, in "Chrome".

Side note:

Veraport20-2,5,2,2 is a software program developed by Wizvera....Relative to the overall usage of users who have this installed on their PCs, most are running Windows Vista (SP2) and Windows 7 (SP1). While about 71% of users of Veraport20-2,5,2,2 come from the United States, it is also popular in Korea. [source]

Really, 71% of users are from the US? That strikes me as very odd. I've never seen this security program in the US, and I can't imagine so high a number coming from just expats with English-language installs. What gives?

Screenshot 15: online banking in IE mode

Here I just wanted to highlight the "IE rendering" module. That warning on the page, by the way, is telling me that if for some reason the security software module isn't loading right, basically just refresh. Thanks.

Screenshot 16: list of plug-ins

And here's the list of Swing Browser plug-ins (not extensions) after letting the KEB-Hana security software do its install thing. All the banking security software looks good. Oh and look, our old friend AhnLab is there too.

Final Thoughts

I was hopeful that with the introduction of Microsoft Edge, which uses a newer, updated rendering engine, would spur the Korean government to ease the requirements for banking security software. But it looks like Microsoft made a wise choice to include IE 11 alongside Edge in Windows 10, as these legacy services look to remain for awhile longer still.

To be honest, while writing this review much of Swing Browser grew on me, and I suddenly started regretting having deleted it a few days ago. But the fact is, I did. It's gone, and it's not going to come back. Why? Well, a few reasons:

Most of my online life is, for better or worse, tied into Google. My bookmarks, passwords, extensions, history, life is all synched through Google. I'm not about to move all that data to a third-rate search company that might not even be around next year. Honestly, if Naver had released this browser instead, then there'd be a decent argument for sucking me in. But Zum? Makes me think more of Mazda than reliable cloud services.

There's no guarantee that this compatibility will remain.Yes, it's very convenient not to have to switch to a different browser all the time. But most of this security software was designed for real IE. I don't know how wise long-term reliance on a third-party company is. Heck, even despite the Open Banking movement here, which was supposed to make Chrome/Firefox/Opera banking possible, I still find that it's often not worth it. Just open up the real deal: IE 11 (or God forbid, sometimes, IE 9 or 10). Better than getting in a stressful fight with Chrome flags.

Swing still uses those Active-X-esque security tools.Don't forget that Swing browser is like a doctor carrying a scalpel in one hand and a saw in the other. Sure, it has modern features, but at least part of the time it relies on the same old technology that we expats love to bitch and moan about. And with potentially good reason. These apps requiring elevated Administrator privilege doesn't sit right with many people. These "security" apps are making deep changes to your system, including to port openings/closings, firewall rules, etc.; changes which can remain even after standard uninstallation. This leads some to recommend doing all your banking/purchasing activity in a virtual machine. That's certainly the safest of available options.

So there you have it. For me, it's still Firefox or Chrome for daily browsing, IE 11 for the times that need it, though I've started loading that in a virtual machine. So far so good.

For me, eh, thanks but no thanks, I'm good. I'd rather we all (Koreans and foreigners both) just do what we gotta do to get by for now, while keeping up the pressure on the banks/government to update themselves rather than downgrade us. It's a tactic that worked, more or less, with smartphones and mobile payments, thanks in part to Korean consumers' love of the iPhone. I think Apple's refusal/inability to concede to Active X several years ago, combined with ordinary Korean consumers' preference for iPhone, forced the hand of banks, online retailers, and government agencies, to create alternative methods for smartphone-based purchasing. If consumer use of Edge and Chrome continues to grow, we might see the same happen on the desktop, which in many ways still lags far behind mobile.

It's weird, really, to come to check-out and have to either fire up my top-of-the-line Android 5 Galaxy Note 4, or my Windows 7 VM with IE 9, to make the purchase. You're either at the bleeding edge, or you're ten years behind everyone else.